How we protect your data
Security is a core requirement of operating an integration platform. This page describes the controls we apply to protect your account, credentials, and business data.
Encryption in transit
All data between your browser, our servers, and third-party APIs is transmitted over TLS 1.2 or higher. Plaintext HTTP is redirected to HTTPS.
OAuth credential encryption
OAuth refresh tokens are encrypted with AES-256-CBC and HMAC integrity verification before storage. The encryption key lives in a protected server environment variable, never in source code or version control.
No plain-text credentials
Access tokens are cached in application memory for their validity window and are never written to the database. No credential value appears in application logs, error reports, or documentation.
Least-privilege access
We request only the OAuth scopes required to deliver the features you use. The initial Google Ads integration requests read-only access. We do not request broader permissions speculatively.
Environment-based secrets
All sensitive configuration values — database credentials, API keys, OAuth client secrets, encryption keys — are stored as protected environment variables on the server. They are never committed to source control.
Audit logging
Key integration events — OAuth flows, account connections, token revocations, account selections — are recorded in an append-only audit log. Log entries cannot be modified or deleted.
Revocation on disconnect
When you disconnect an integration, Whosta is designed to immediately revoke the OAuth refresh token at the provider, delete the stored credential, and clear any cached access tokens. This functionality is active when the integration is enabled.
Session security
Session identifiers are rotated after OAuth flows to prevent session fixation. Sessions use secure, HTTP-only cookies with CSRF protection.
Dependency and update management
We review application dependencies for known vulnerabilities and apply security updates on a regular basis. Our infrastructure provider maintains current security patches on the underlying host.
Access controls
Every database query and API call is scoped to the authenticated user’s own data. We implement controls to prevent users from accessing data belonging to other accounts (insecure direct object reference prevention). Server infrastructure access is restricted to authorised personnel using SSH key authentication.
Backups and availability
Application data is backed up regularly. Backups are stored separately from the primary database. In the event of data loss, we will restore from the most recent backup available and notify affected users.
We aim to provide a reliable service but do not guarantee uninterrupted availability. Planned maintenance windows will be communicated in advance where possible.
Incident handling
In the event of a security incident that affects personal data, we will notify affected users and, where required by the GDPR, the competent supervisory authority within the applicable legal timeframes. We will describe the nature of the incident, the data involved, and the steps we have taken or are taking to address it.
Your responsibilities
- Use a strong, unique password for your Whosta account.
- Keep your login credentials confidential and do not share them.
- Connect only Google Ads accounts and stores that you own or are explicitly authorised to manage.
- Disconnect integrations from your Whosta dashboard when you no longer need them.
- Report any suspicious activity on your account to support@whosta.com promptly.
Responsible disclosure
If you believe you have found a security vulnerability in Whosta, please report it to us responsibly before disclosing it publicly. We will investigate all credible reports and respond as quickly as possible.
To report a vulnerability:
Email: support@whosta.com
Subject line: Security Report
Please include: a description of the issue, steps to reproduce it, and the potential impact. Do not include any live credentials, customer data, or personal data in your report.
We will acknowledge your report within 3 business days. We ask that you give us reasonable time to investigate and address the issue before any public disclosure.